Medical Device Vulnerabilities: What to Protect & How to Protect It

Each of these hardware features poses some inherent risk. The utility of these features is predicated entirely on standardization -- which means each of these technologies is readily available to potential malicious actors.

In most cases, it is not practical to reinvent data storage or transport technologies as alternatives to USB, WiFi, BT, or Ethernet. Typical strategies for reducing these risks include device pairing, password protection, data encryption, and data format. Though the scope of this article does not allow an in-depth exploration of all possible mitigation measure, we’ll review several of these briefly.

Device pairing
Device pairing is a method (familiar from BT) that requires specific instances of a device (i.e. a particular sensor, a particular WiFi hub, a particular PC, etc.) and limits access to the device only to explicitly paired devices. This strategy can be layered on top of communication between any pair of devices where the protocol already provides a handshake that shares device ID, or where it is possible to add some custom software to share and record device IDs and authentication.

It is also possible to implement pairing via a back-end service, accessible from the host device, that stores approved pairings in a single database. One advantage of a global database (similar to IMEI numbers for cellphones) is that it allows early detection of counterfeit devices (duplicate IDs). Of course, one disadvantage is that it requires a convenient connection between the host device and the back-end service, something that is not always possible or practical, especially in countries with underdeveloped infrastructure or technologically reluctant or low-income patients without easy Internet access or reliable phone service.

Password protection
Passwords are a valuable tool for preventing unauthorized access, and can be implemented in a wide range of schemes that balance between usability, convenience, and security.

Data encryption
Data encryption might be considered passé as the increase in computing power and the increased sophistication of factorization techniques has made public key encryption methods subject to some attacks. DI Management offers a good description of some of the mathematics and weaknesses behind public key encryption and RSA, in particular. Additionally, PKI methods require additional computational power to encrypt and decrypt data that may not be practical in all circumstances.

Data formats
Data formats is likely to be considered by many the most naïve method in this list. However, it is worth mentioning at least partly because it is naïve, relatively easy to implement, and can provide some deterrent for the most casual malicious actors. This can be as simple as defining custom messages to communicate via WiFi, Ethernet, ZigBee, or using a binary file format rather than a more convenient text-based file format. It could also be as elaborate as a custom file system to protect data, a custom USB class, or a new set of op-codes and an interpreter to protect company IP included in the software executable image.

Conclusion
This overview of four well-known techniques is hardly an exhaustive treatment of these techniques, and there are others (signing, certificates, custom bearers, biometrics, redundant authentication, physical keys) that are also valuable tools that can be used appropriately in some circumstances.

The enhancements from new technology to patient safety, treatment efficacy, and the user experience for both patients and healthcare professionals are significant. Innovative companies will find ways to incorporate these technologies to increase the value proposition of their product offerings. To be competitive, device manufacturers will need to find ways to utilize these technologies effectively and address the associated security issues. The good news is that security issues can be addressed by a combination of mitigations and product requirements.

This is why medical devices are so expensive, the copious levels protection. When it comes to lives at risk, everything should be considered for testing. I'm not a big advocate of IP protection, but foreign companies are always looking to copy top-dollar products.

The high cost of medical devices is due in part to a longer history of liability problems than of leaked data, a much more recent concern. Other factors like very high performance and the high cost of middlemen no doubt contribute yet more cost. But I think Cabe's point about leaked data is a good one--that's probably going to be a contributing factor to higher device costs in the near future.

Alan, I'm curious how important it is to have a secure operating system for some of these medical devices. We often see operating systems decribed in terms of levels or security -- what level of security should designers aspire to?

Charles, first off apologies for the delay in responding. I lost track of when the article was going live. The level of level of security depends on the safetly classification of the device. In cases of lowest patient risk something like SELinux or SEAndroid (Security Ehanced) may be appropriate. In cases of higher risk most closed source OS options that offer packages specifically for medical device development will be closed-source, and provide an appropriate level of security as a starting point. In terms of networked devices one aspect of security outside scope of my post is IT policy. The range and nature of devices that connect to your network, and whether or not persistent storage is all encrypted, and whether it's possible to install new apps, etc all contribute to overall security.

Interesting article - the layered strategy makes good sense as well as not advertising any specifics about the security methods that are in place. A lot of what was said applies to technology in general as well. Too bad we can't direct the energy and innovation that must be used to make products secure to enhance perofrmance instead. Malicious attacks on medical devices is a sad statement of our society - but then, I have never understood why so many hackers waste so much time and energy to cause problems when they could direct their abilities towards doing good and contributing to society with their accomplishments...

Nancy, first off apologies for the delay in responding. I lost track of when the article was going live. Absolutely most of what I described is generally applicable to consumer devices as well as medical devices. Device and information security is generally a fairly mature and active area of development, and I was trying to illustrate some of the areas where medical device designers and manufacturers should be paying more attention to security, in an environment that historically has had fewer security concerns (non-networked devices, used in controlled environments, by trained health care professionals).

I certainly see your point, Alan. Current trends are taking technology usage out of the hands of specialists and into those of less technical users who may inadvertently create a security breach that allows sensitive information to either be accessed or corrupted. Networking is definitely on the increase in medical applications for easier sharing of data - I can see how this increases the need for security...

From a patient safety standpoint, I'm not as concerned with the pirating of medical information as I am about a hacker who infiltrates the medical device with malicious intent. I think we should consider ways to mitigate hacker risk if a medical device is connected to a network and could be vulnerable to an attack on its operating system (where applicable).

Greg, first off apologies for the delay in responding. I lost track of when the article was going live. I agree completely. The focus of the article was intended to be FDA regulated devices, not so much data protection that would be governed by HIPAA. In fact I was motivated to write because of the reports in 2011 that an insulin pump had been successfully hacked, and was able to be programmed maliciously over a wireless connection.

Thanks all for your comments on the article. Apologies for the delay in responding. I lost track of when the article was going live. I think there are three main contributors to the cost of medical devices. One is definitely the higher development costs to meet regulatory and safety requirements. However the "typical" medical device takes much less overall cost to develop than the iPhone for example. Liability is another big piece, and I think the third important piece is the relatively low volumes. At Logic PD I have worked with a variety of very recognizable device manufacturers, and volumes for some of the devices that we've worked on with large-scale development efforts can be in the 100's per year. If you sell only about 1,000 in ten years every million you spend on development adds $1000 to the cost of each unit. Such low volumes also increases the cost of the components that go into the device (buying a million memory chips is a much lower unit cost than buying 100).

Using a unique data format is an often overlooked area of security. Simply packing bytes and using bit fields not only makes the data packet smaller, but does prevent all bit the technically savvy from monitoring the data.

The standards electrical machines and components are required to meet in the food processing industry are far more stringent than those in traditional plant construction. For specialized production environments such as these, components must not only resist thermal and physical stresses, but they must also be resistant to the chemicals used to sterilize equipment.

The word “smart” is becoming the dumbest word around. It has been applied to almost every device and system in our homes. In addition to smartphones and smart meters, we now hear about smart clothing and smart shoes, smart lights, smart homes, smart buildings, and every trendy city today has its smart city project. Just because it has a computer inside and is connected to the Web, does not mean it is smart.

Was Steve Job’s signature outfit of a black turtleneck, jeans, and sneakers the secret behind his success? Maybe, or maybe not, but it was likely an indication of a decision-making philosophy that enabled him to become one of the most successful innovators of all time.

Focus on Fundamentals consists of 45-minute on-line classes that cover a host of technologies. You learn without leaving the comfort of your desk. All classes are taught by subject-matter experts and all are archived. So if you can't attend live, attend at your convenience.